feat: audit --fix writes the missing paths into workflow filters

[MarkAlex1234]

Summary

 dynamic-monorepo audit          # reports drifted on.*.paths filters
+dynamic-monorepo audit --fix    # writes the missing entries, edits nothing else

audit --fix
  for each workflow with findings
    for each finding with a fix              (missing dependency folder → add `dir/**`;
      locate on.<event>.paths in the text     bare directory → `dir` becomes `dir/**`)
      edit the block or flow list, keeping indentation, quoting, comments and CRLF
      re-parse: the document must equal the original with only that list changed
      otherwise leave the file alone and report the finding as "left"
  exit 0 when nothing is left, 1 otherwise

Why: maintainers merge our path-filter fixes but often won't add a third-party action ("we avoid third-party actions in CI", devlint/GitWand#210). --fix gives them the result with no CI dependency, and every fix PR can say how to rerun it.

Evidence

• New tests: block lists with comments, flow lists with plain scalars and CRLF, anchors and aliases left untouched, --fix rejected outside audit. tsc, build and vitest: 129 passed, 1 skipped.
• Real repos (shallow clones from the outreach scans):

Repo	Findings	Fixed	Left	Audit after
voquill	8	8	0	0
nordcraft	3	3	0	0
Conduit	4	4	0	0
appkit	3	3	0	0
foldkit	3	3	0	0
reloop (22 workflows)	306	306	0	0
MCPJam inspector	10	10	0	0
modrinth	17	17	0	0
explorer-1	12	12	0	0
zentinel	4	4	0	0
idem	10	10	0	0
discourse-graph	15	15	0	0

Every edited workflow still parses, and only lines inside paths: were added. A flow list ([...]) is rewritten on its one line.

Merge danger

Door: two-way (CLI flag only; the Action is unchanged).

Blast radius: CLI users who pass --fix.

[claude]

Looks good. src/fix.ts re-parses every edit and requires the result to equal the original document with only that paths list changed. Anything else is left alone and reported, so a mis-edit is unlikely to land silently. Text edits never go through a shell, which follows the untrusted-input rule. I found no blocking issues.

Not verified: I didn't run the build or tests, and I didn't diff the rebuilt dist/ against the source.

Minor, non-blocking: in flow lists, lastIndexOf(']') can match a ] inside a trailing comment. The re-parse check catches this and the finding is reported as "left", so the cost is a missed fix, not a bad edit.

[claude]

Looks good. The re-parse check (only the targeted paths list may differ) is a solid safety net, and the CLI is gated properly (--fix rejected outside audit). I couldn't run the build or tests here, so I judged from the diff.

Non-blocking notes:

• fixAudit (src/cli.ts) calls writeFileSync on join(top, file). Per AGENTS.md, repo contents are untrusted: a workflow file that is a symlink pointing outside the repo would be written through. Consider skipping symlinks (lstatSync).
• fixOne normalizes mixed line endings to a single eol (lines.join(eol)), and the re-parse can't detect that. This could produce a larger diff than "edits only the paths list" promises.
• Appending dir/** to the end of a list that contains !negated patterns changes the filter's meaning, because order matters in GitHub path filters. The parse check can't see this. Consider inserting before the first ! entry, or skipping the fix when the list contains negations.
• fix.add already present returns the text unchanged and is counted as "fixed", which slightly inflates the summary count.